Powershell script to force the removal of SEP when the uninstall doesn't work
Created: 24 Jun 2010 | Updated: 28 Jun 2010 | 11 comments
These scripts will remove SEP from machines were the uninstall doesn't work.
You will need to run Part 1, reboot, then run Part 2
NOTE: rename the file extensions from .TXT to .PS1
Group Ownership:
Comments 11 Comments • Jump to latest comment
How is the script initialized/ run?
I am installing v 12 on my PC (have installed on 49 others already). The install starts and seems to go but when it gets to the point of doing the Live update it vanishes with no indication in add/ remove programs that it is installed.
Any help would be appreciated. Thank you.
I will try. Thank you
exactly i wanted this yesterday....
i ll check it
thanks anyway bro
HenryCharles Thanks much :)
Don't forget to mark your thread as 'solved' with the answer that best helped you!
Henry
after changing the extension from .txt to .PS1 its going in unknow format..is this extension correct ?
Make sure you have Powershell installed on the affected system(s)
You have to run the script from Powershell prompt "not the DOS command prompt"
You will most likely receive an error about running an unsigned script. The get around that issue you'll need to type the following command in the Powershell prompt "Set-ExecutionPolicy Unrestricted"
Note: don't forget to run this command in the Powershell prompt when you're done to set back the security:
"Set-ExecutionPolicy restricted"
Hope this helps!
an update for SEP12.1 would be lovely =)
A GUI tool that does the same is called CleanWipe. The current version is v12.1.671.4971 and seem to be available only via Symantec Support. No direct download available.
I've used CleanWipe [its a great tool] but, there are times even the cleanwipe tool doesn't work. These script rip it out by brute force so that you can re-install it.
thank you .. however I get below error when i try to excute part 1 of the script...please advise.
The string starting:
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:303 char:78
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus <<<< " -Force
is missing the terminator: ".
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:309 char:75
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force <<<<
+ CategoryInfo : ParserError: ( -Force
Remove...psHelper -Force:String) [], ParseException
+ FullyQualifiedErrorId : TerminatorExpectedAtEndOfString
Removed the below lines from 303 & 309 "Symantec AntiVirus” and the last line (309)
Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus" -Force
Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force
However we get the same error again with line which has last "Symantec AntiVirus” (292)and the last line(307)
The string starting:
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:292 char:99
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\Eventlog\Application\"Symantec AntiVirus <<<< " -Force
is missing the terminator: ".
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:307 char:69
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WPS -Force <<<<
+ CategoryInfo : ParserError: ( -Force
Remove...ices\WPS -Force:String) [], ParseException
+ FullyQualifiedErrorId : TerminatorExpectedAtEndOfString
first thx henrycharles for this awesome script.
But i found in SymantecSEPRemoval_Part1.TXT in Line 275 Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection -Force this sign " is missing and throws the error.
So change to Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection" -Force
and all works fine!
Do not kill lines, just check the code. ;-)
I attached changed script.
Would you like to reply?
Login or Register to post your comment.